Windows Vista: Seit ich kürzlich am PC eine Umfrage beantwortet habe, bekomme ich ständig bei d

Hiho,

downloade dir das Pogramm Malwarebyts.
Update das Pogramm,und dann scanst du dein System im abgesicherten Modus.
Vorher aber  Systemwiederherstellung deaktivieren.
Funde löschen lassen und report posten.


Download Link

Marlwarebyts 

Danke für die Hilfe. Hat wunderbar geklappt.

Report bitte Posten, nur weil jetzt keine Probleme mehr da sind, heißt es nicht dass das System auch sauber ist!

Was bitte heisst:"Report Posten"? Bitte erkläre.

Das ist der log von dem scan

bitte den bericht hier reinstellen.
Nachträglich kannst du den Bericht unter "Scan-Berichte" finden.

Malwarebytes' Anti-Malware 1.34
Datenbank Version: 1753
Windows 6.0.6001 Service Pack 1

12.02.2009 17:20:49
mbam-log-2009-02-12 (17-20-49).txt

Scan-Methode: Vollständiger Scan (C:\|D:\|)
Durchsuchte Objekte: 178505
Laufzeit: 54 minute(s), 5 second(s)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 3
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 1

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\MSFox (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Casino King (Adware.Casino) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Casino King (Adware.Casino) -> Quarantined and deleted successfully.

Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
C:\Program Files\Ascentive\Performance Center\ApcMain.exe (Rogue.AscentivePerformance) -> Quarantined and deleted successfully.
 

malwarebytes scheint nicht ganz gründlic gewesen zu sein.
1. combofix:
http://74.125.77.132/search?q=cache:DJBkOApY18kJ:virus-protect.org/artikel/tools/combofix.html+combofix%2Bvirus+protect&hl=de&ct=clnk&cd=1&gl=de
ausfüren, log posten
2. hijackthis:
http://virus-protect.org/hjtkurz.html
ausfüren, log posten

ComboFix 09-02-12.03 - LM 2009-02-13 14:56:41.1 - NTFSx86
Microsoft® Windows Vista™ Home Premium   6.0.6001.1.1252.1.1031.18.3070.2043 [GMT 1:00]
ausgeführt von:: c:\users\LM\Desktop\ComboFix.exe
 * Neuer Wiederherstellungspunkt wurde erstellt
.

((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\users\LM\AppData\Local\lptae.dat
c:\users\LM\AppData\Local\lptae.exe
c:\users\LM\AppData\Local\lptae_nav.dat
c:\users\LM\AppData\Local\lptae_navps.dat

.
(((((((((((((((((((((((   Dateien erstellt von 2009-01-13 bis 2009-02-13  ))))))))))))))))))))))))))))))
.

2009-02-12 16:22 . 2009-02-12 16:22   <DIR>   d--------   c:\users\LM\AppData\Roaming\Malwarebytes
2009-02-12 16:22 . 2009-02-12 16:22   <DIR>   d--------   c:\users\All Users\Malwarebytes
2009-02-12 16:22 . 2009-02-12 16:22   <DIR>   d--------   c:\programdata\Malwarebytes
2009-02-12 16:22 . 2009-02-12 16:22   <DIR>   d--------   c:\program files\Malwarebytes' Anti-Malware
2009-02-12 16:22 . 2009-02-11 10:19   38,496   --a------   c:\windows\System32\drivers\mbamswissarmy.sys
2009-02-12 16:22 . 2009-02-11 10:19   15,504   --a------   c:\windows\System32\drivers\mbam.sys
2009-02-10 19:07 . 2009-02-10 19:07   <DIR>   d--------   c:\users\All Users\NCH Software
2009-02-10 19:07 . 2009-02-10 19:07   <DIR>   d--------   c:\programdata\NCH Software
2009-02-10 12:49 . 2009-02-10 12:49   <DIR>   d--------   c:\users\LM\AppData\Roaming\Recordpad
2009-02-10 12:49 . 2009-02-10 19:07   <DIR>   d--------   c:\program files\NCH Software
2009-02-08 18:58 . 2009-02-08 18:58   <DIR>   d--------   c:\users\LM\AppData\Roaming\Xilisoft Corporation
2009-02-08 18:28 . 2009-02-08 18:28   <DIR>   d--------   c:\program files\Xilisoft
2009-02-06 13:25 . 2009-02-06 13:25   <DIR>   d--------   c:\program files\Common Files\Adobe AIR
2009-02-06 04:46 . 2009-02-06 04:46   <DIR>   d--------   C:\Boot
2009-02-05 20:23 . 2009-02-05 20:23   <DIR>   d--------   c:\program files\Modem Diagnostic Tool
2009-02-05 20:20 . 2009-02-05 20:20   <DIR>   d--------   c:\windows\System32\vmm32
2009-02-05 19:10 . 2008-01-19 08:45   333,203   -rahs----   C:\bootmgr
2009-02-05 18:18 . 2009-02-05 18:29   <DIR>   d--------   c:\program files\Avira
2009-02-04 12:02 . 2009-02-04 12:03   <DIR>   d--------   C:\12.000 Office Vorlagen Teil 3
2009-01-31 19:14 . 2009-02-08 01:13   <DIR>   d--------   c:\program files\Free Download Manager
2009-01-24 18:25 . 2009-01-24 18:25   <DIR>   dr-------   c:\windows\System32\config\systemprofile\Videos
2009-01-24 18:25 . 2009-01-24 18:25   <DIR>   dr-------   c:\windows\System32\config\systemprofile\Searches
2009-01-24 18:25 . 2009-01-24 18:25   <DIR>   dr-------   c:\windows\System32\config\systemprofile\Saved Games
2009-01-24 18:25 . 2009-01-24 18:25   <DIR>   dr-------   c:\windows\System32\config\systemprofile\Pictures
2009-01-24 18:25 . 2009-01-24 18:25   <DIR>   dr-------   c:\windows\System32\config\systemprofile\Music
2009-01-24 18:25 . 2009-01-24 18:25   <DIR>   dr-------   c:\windows\System32\config\systemprofile\Links
2009-01-24 18:25 . 2009-01-24 18:25   <DIR>   dr-------   c:\windows\System32\config\systemprofile\Downloads
2009-01-24 18:25 . 2009-01-24 18:25   <DIR>   dr-------   c:\windows\System32\config\systemprofile\Documents
2009-01-24 18:06 . 2009-02-05 20:03   <DIR>   d--------   c:\program files\Deutsche Rechtschreibung
2009-01-24 17:57 . 2009-02-05 20:03   <DIR>   d--------   c:\users\LM\AppData\Roaming\Balabolka
2009-01-24 17:57 . 2009-02-05 20:03   <DIR>   d--------   c:\program files\Balabolka
2009-01-24 16:52 . 2009-01-24 16:52   <DIR>   d--------   c:\users\All Users\Microsoft Corporation
2009-01-24 16:52 . 2009-01-24 16:52   <DIR>   d--------   c:\programdata\Microsoft Corporation
2009-01-24 16:31 . 2009-02-05 20:03   <DIR>   d--hs----   C:\$RECYCLE.BIN
2009-01-24 15:53 . 2009-02-05 19:35   55   --a------   C:\$DRVLTR$
2009-01-24 15:52 . 2009-02-06 04:30   8,192   -ra-s----   C:\BOOTSECT.BAK
2009-01-24 15:35 . 2009-02-05 18:54   2   -rahs----   C:\$drvmig$
2009-01-24 14:16 . 2009-02-05 20:03   <DIR>   d--------   c:\program files\Microsoft Windows Vista Upgrade Advisor
2009-01-24 14:12 . 2009-01-24 16:52   1,905   --a------   c:\windows\diagwrn.xml
2009-01-24 14:12 . 2009-01-24 16:52   1,905   --a------   c:\windows\diagerr.xml
2009-01-24 01:15 . 2009-01-24 01:15   <DIR>   d--------   c:\windows\Downloaded Installations
2009-01-24 00:56 . 2009-02-06 04:44   <DIR>   d--------   c:\program files\BlablaMaker
2009-01-24 00:34 . 2009-02-06 04:44   <DIR>   d--------   c:\program files\TextAloud
2009-01-24 00:28 . 2009-01-24 00:28   <DIR>   d--------   c:\users\LM\AppData\Roaming\Download Manager
2009-01-22 19:15 . 2009-01-22 19:15   <DIR>   d--------   c:\users\All Users\NextUp
2009-01-22 19:15 . 2009-01-22 19:15   <DIR>   d--------   c:\programdata\NextUp
2009-01-22 17:44 . 2009-02-05 20:03   <DIR>   d--------   c:\program files\7-Zip
2009-01-22 16:39 . 2009-02-05 20:04   <DIR>   d--------   c:\windows\Lhsp
2009-01-21 13:16 . 2009-01-21 13:16   <DIR>   d--------   c:\users\LM\AppData\Roaming\NCH Software
2009-01-21 13:05 . 2009-02-10 12:49   <DIR>   d--------   c:\users\LM\AppData\Roaming\NCH Swift Sound
2009-01-21 13:05 . 2009-02-10 19:06   <DIR>   d--------   c:\users\All Users\NCH Swift Sound
2009-01-21 13:05 . 2009-02-10 19:06   <DIR>   d--------   c:\programdata\NCH Swift Sound
2009-01-21 13:05 . 2009-02-10 19:06   <DIR>   d--------   c:\program files\NCH Swift Sound
2009-01-20 13:44 . 2003-05-22 00:50   1,700,352   --a------   c:\windows\System32\GdiPlus.dll
2009-01-20 12:23 . 2009-02-12 12:28   <DIR>   d--------   c:\users\LM\Winterbibelschule_2009
2009-01-14 14:54 . 2009-01-14 14:54   <DIR>   d--------   c:\users\All Users\nightclub.de
2009-01-14 14:54 . 2009-01-14 14:54   <DIR>   d--------   c:\programdata\nightclub.de
2009-01-14 14:53 . 2009-01-14 14:54   <DIR>   d--------   c:\program files\nightclub.de
2009-01-14 14:26 . 2009-02-03 19:26   <DIR>   d--------   c:\program files\Ascentive
2009-01-14 14:26 . 2007-08-10 12:56   303,104   --a------   c:\windows\System32\ciplListBar.ocx
2009-01-14 14:26 . 2008-05-05 14:08   208,896   --a------   c:\windows\System32\ConTest.dll
2009-01-14 14:26 . 2007-08-10 12:56   155,648   --a------   c:\windows\System32\ciplImageList.ocx
2009-01-14 09:32 . 2008-12-16 03:42   288,768   --a------   c:\windows\System32\drivers\srv.sys
2009-01-13 19:26 . 2009-02-05 20:03   <DIR>   d--------   c:\program files\Kaminfeuer Titanium Edition II
2009-01-13 19:26 . 2008-06-19 19:54   7,907,328   --a------   c:\windows\Kaminfeuer Titanium Edition II.scr
2009-01-13 19:26 . 2008-06-19 19:54   193,296   --a------   c:\windows\System32\MCI32.OCX
2009-01-13 19:26 . 2008-06-19 19:54   34,816   --a------   c:\windows\System32\MCIDE.dll
2009-01-13 19:20 . 2008-06-19 19:54   1,355,776   --a------   c:\windows\System32\MSVBVM50.dll
2009-01-13 19:20 . 2008-06-19 19:54   99,866   --a------   c:\windows\System32\VB5DE.dll
2009-01-13 19:20 . 2008-06-19 19:54   72,704   --a------   c:\windows\ST5UNST.EXE
2009-01-13 19:20 . 2008-06-19 19:54   29,696   --a------   c:\windows\System32\VB5StKit.dll

.
((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-02-13 09:01   ---------   d-----w   c:\programdata\Google Updater
2009-02-13 08:46   ---------   d-----w   c:\program files\Windows Mail
2009-02-12 12:42   ---------   d-----w   c:\programdata\Roxio
2009-02-06 03:45   ---------   d-----w   c:\users\LM\AppData\Roaming\Template
2009-02-06 03:44   ---------   d-----w   c:\programdata\Sonic
2009-02-06 03:44   ---------   d-----w   c:\programdata\Premiere
2009-02-06 03:44   ---------   d-----w   c:\programdata\NOS
2009-02-06 03:44   ---------   d-----w   c:\programdata\maxdome
2009-02-06 03:44   ---------   d-----w   c:\programdata\IM
2009-02-06 03:44   ---------   d-----w   c:\programdata\Avira
2009-02-06 03:44   ---------   d-----w   c:\program files\PDF Blender
2009-02-06 03:44   ---------   d-----w   c:\program files\e-Sword
2009-02-06 03:44   ---------   d-----w   c:\program files\Digital TV 2050
2009-02-05 19:20   ---------   d-----w   c:\program files\Dell
2009-02-05 16:24   ---------   d--h--w   c:\program files\InstallShield Installation Information
2009-02-05 16:24   ---------   d-----w   c:\program files\Premiere
2009-01-24 17:25   ---------   d-----w   c:\program files\ScanSoft
2009-01-22 15:45   ---------   d-----w   c:\programdata\WinZip
2009-01-20 12:59   ---------   d-----w   c:\program files\Common Files\AVSMedia
2009-01-20 12:59   ---------   d-----w   c:\program files\AVS4YOU
2009-01-20 12:44   ---------   d-----w   c:\users\LM\AppData\Roaming\AVS4YOU
2009-01-14 13:55   ---------   d-----w   c:\programdata\gotomaxx
2009-01-14 13:55   ---------   d-----w   c:\program files\gotomaxx
2009-01-12 13:39   ---------   d-----w   c:\program files\MMEDIA
2008-12-22 16:25   ---------   d-----w   c:\users\LM\AppData\Roaming\Participatory Culture Foundation
2008-12-22 16:25   ---------   d-----w   c:\program files\Participatory Culture Foundation
2008-12-20 23:30   ---------   d-----w   c:\users\LM\AppData\Roaming\DivX
2008-12-20 18:55   ---------   d-----w   c:\users\LM\AppData\Roaming\Blender Foundation
2008-12-20 18:55   ---------   d-----w   c:\program files\Blender Foundation
2008-12-19 13:42   465,312   ----a-w   c:\windows\System32\Quarks&Co Screensaver.scr
2008-12-19 13:42   ---------   d-----w   c:\program files\WDR Fernsehen
2008-12-18 01:03   ---------   d-----w   c:\users\LM\AppData\Roaming\gotomaxx
2008-12-17 19:57   ---------   d-----w   c:\program files\Common Files\Adobe
2008-12-17 19:37   ---------   d-----w   c:\program files\NOS
2008-11-21 21:44   161,096   ----a-w   c:\windows\System32\DivXCodecVersionChecker.exe
2008-10-20 13:16   192   ----a-w   c:\users\LM\AppData\Roaming\wklnhst.dat
2008-07-08 18:53   174   --sha-w   c:\program files\desktop.ini
.

 

.
((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-02-13 09:01   ---------   d-----w   c:\programdata\Google Updater
2009-02-13 08:46   ---------   d-----w   c:\program files\Windows Mail
2009-02-12 12:42   ---------   d-----w   c:\programdata\Roxio
2009-02-06 03:45   ---------   d-----w   c:\users\LM\AppData\Roaming\Template
2009-02-06 03:44   ---------   d-----w   c:\programdata\Sonic
2009-02-06 03:44   ---------   d-----w   c:\programdata\Premiere
2009-02-06 03:44   ---------   d-----w   c:\programdata\NOS
2009-02-06 03:44   ---------   d-----w   c:\programdata\maxdome
2009-02-06 03:44   ---------   d-----w   c:\programdata\IM
2009-02-06 03:44   ---------   d-----w   c:\programdata\Avira
2009-02-06 03:44   ---------   d-----w   c:\program files\PDF Blender
2009-02-06 03:44   ---------   d-----w   c:\program files\e-Sword
2009-02-06 03:44   ---------   d-----w   c:\program files\Digital TV 2050
2009-02-05 19:20   ---------   d-----w   c:\program files\Dell
2009-02-05 16:24   ---------   d--h--w   c:\program files\InstallShield Installation Information
2009-02-05 16:24   ---------   d-----w   c:\program files\Premiere
2009-01-24 17:25   ---------   d-----w   c:\program files\ScanSoft
2009-01-22 15:45   ---------   d-----w   c:\programdata\WinZip
2009-01-20 12:59   ---------   d-----w   c:\program files\Common Files\AVSMedia
2009-01-20 12:59   ---------   d-----w   c:\program files\AVS4YOU
2009-01-20 12:44   ---------   d-----w   c:\users\LM\AppData\Roaming\AVS4YOU
2009-01-14 13:55   ---------   d-----w   c:\programdata\gotomaxx
2009-01-14 13:55   ---------   d-----w   c:\program files\gotomaxx
2009-01-12 13:39   ---------   d-----w   c:\program files\MMEDIA
2008-12-22 16:25   ---------   d-----w   c:\users\LM\AppData\Roaming\Participatory Culture Foundation
2008-12-22 16:25   ---------   d-----w   c:\program files\Participatory Culture Foundation
2008-12-20 23:30   ---------   d-----w   c:\users\LM\AppData\Roaming\DivX
2008-12-20 18:55   ---------   d-----w   c:\users\LM\AppData\Roaming\Blender Foundation
2008-12-20 18:55   ---------   d-----w   c:\program files\Blender Foundation
2008-12-19 13:42   465,312   ----a-w   c:\windows\System32\Quarks&Co Screensaver.scr
2008-12-19 13:42   ---------   d-----w   c:\program files\WDR Fernsehen
2008-12-18 01:03   ---------   d-----w   c:\users\LM\AppData\Roaming\gotomaxx
2008-12-17 19:57   ---------   d-----w   c:\program files\Common Files\Adobe
2008-12-17 19:37   ---------   d-----w   c:\program files\NOS
2008-11-21 21:44   161,096   ----a-w   c:\windows\System32\DivXCodecVersionChecker.exe
2008-10-20 13:16   192   ----a-w   c:\users\LM\AppData\Roaming\wklnhst.dat
2008-07-08 18:53   174   --sha-w   c:\program files\desktop.ini
.

((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{201f27d4-3704-41d6-89c1-aa35e39143ed}]
2008-07-17 17:20   279944   --a------   c:\program files\AskBarDis\bar\bin\askBar.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{3041d03e-fd4b-44e0-b742-2d9b88305f98}"= "c:\program files\AskBarDis\bar\bin\askBar.dll" [2008-07-17 279944]

[HKEY_CLASSES_ROOT\clsid\{3041d03e-fd4b-44e0-b742-2d9b88305f98}]
[HKEY_CLASSES_ROOT\TypeLib\{4b1c1e16-6b34-430e-b074-5928eca4c150}]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{3041D03E-FD4B-44E0-B742-2D9B88305F98}"= "c:\program files\AskBarDis\bar\bin\askBar.dll" [2008-07-17 279944]

[HKEY_CLASSES_ROOT\clsid\{3041d03e-fd4b-44e0-b742-2d9b88305f98}]
[HKEY_CLASSES_ROOT\TypeLib\{4b1c1e16-6b34-430e-b074-5928eca4c150}]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DellSupportCenter"="c:\program files\Dell Support Center\bin\sprtcmd.exe" [2008-08-13 206064]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-19 125952]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-19 202240]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ECenter"="c:\dell\E-Center\EULALauncher.exe" [2008-02-29 17920]
"Google Desktop Search"="c:\program files\Google\Google Desktop Search\GoogleDesktop.exe" [2008-06-04 29744]
"dscactivate"="c:\program files\Dell Support Center\gs_agent\custom\dsca.exe" [2008-03-11 16384]
"DellSupportCenter"="c:\program files\Dell Support Center\bin\sprtcmd.exe" [2008-08-13 206064]
"SSBkgdUpdate"="c:\program files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" [2003-10-14 155648]
"PaperPort PTD"="c:\program files\ScanSoft\PaperPort\pptd40nt.exe" [2005-03-17 57393]
"IndexSearch"="c:\program files\ScanSoft\PaperPort\IndexSearch.exe" [2005-03-17 40960]
"BrMfcWnd"="c:\program files\Brother\Brmfcmon\BrMfcWnd.exe" [2007-02-15 622592]
"ControlCenter3"="c:\program files\Brother\ControlCenter3\brctrcen.exe" [2006-07-19 65536]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2008-09-25 413696]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 34672]
"tvjbmonitor"="c:\program files\MMEDIA\TV Jukebox 3.1\tvjbMonitor.exe" [2006-12-26 53248]
"Recordpad"="c:\program files\NCH Swift Sound\Recordpad\recordpad.exe" [2009-02-10 577540]
"BroadCamRun"="c:\program files\NCH Software\BroadCam\broadCam.exe" [2009-02-10 368644]
"RtHDVCpl"="RtHDVCpl.exe" [2007-09-24 c:\windows\RtHDVCpl.exe]

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
w98Eject.lnk - c:\windows\System\w98eject.exe [2008-11-20 61440]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\GoToAssist]
2008-06-04 17:18 10536 c:\program files\Citrix\GoToAssist\514\g2awinlogon.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\progra~1\Google\GOOGLE~2\GOEC62~1.DLL

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.SP54"= SP5X_32.DLL
"VIDC.SP55"= SP5X_32.DLL
"VIDC.SP56"= SP5X_32.DLL
"VIDC.SP57"= SP5X_32.DLL
"VIDC.SP58"= SP5X_32.DLL

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiSpyware]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
"AntiVirusOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{0A4B5BC8-B1A5-4D28-9210-070E62CB8436}"= Disabled:UDP:c:\users\LM\AppData\Local\Temp\WZSE0.TMP\fsetup.exe:AVM FSetup Application
"{AD1185A5-9383-4D02-B11F-F6829F085DC2}"= Disabled:TCP:c:\users\LM\AppData\Local\Temp\WZSE0.TMP\fsetup.exe:AVM FSetup Application
"{69CFF090-86CD-4AB9-9948-65D1A35F406F}"= Disabled:UDP:E:\fsetup.exe:AVM FSetup Application
"{4CB7885C-DC11-43B3-B747-3BA6D79E5721}"= Disabled:TCP:E:\fsetup.exe:AVM FSetup Application
"{D1E1582F-BF54-423F-8DAE-67863E241801}"= Disabled:UDP:c:\program files\IncrediMail\bin\ImApp.exe:IncrediMail
"{808C8195-F32A-4692-AE12-13900661A1B7}"= Disabled:TCP:c:\program files\IncrediMail\bin\ImApp.exe:IncrediMail
"{1A8AC9FE-9761-4844-BA2E-79EA24B28920}"= Disabled:UDP:c:\program files\IncrediMail\bin\ImpCnt.exe:IncrediMail
"{5B4FE12C-0A02-4BC0-ACD8-0BD172BEE644}"= Disabled:TCP:c:\program files\IncrediMail\bin\ImpCnt.exe:IncrediMail
"TCP Query User{DB517C71-8B2A-440B-A545-32126986B722}c:\\program files\\real\\realplayer\\realplay.exe"= UDP:c:\program files\real\realplayer\realplay.exe:RealPlayer
"UDP Query User{A21705FA-5901-49AE-83FF-4606C7FF1E71}c:\\program files\\real\\realplayer\\realplay.exe"= TCP:c:\program files\real\realplayer\realplay.exe:RealPlayer
"{E3B4E669-F536-4497-9B4C-36E1EE4D2CEA}"= Disabled:UDP:c:\program files\IncrediMail\bin\IncMail.exe:IncrediMail
"{C0CD764B-B166-444F-9ACD-D828AFD85975}"= Disabled:TCP:c:\program files\IncrediMail\bin\IncMail.exe:IncrediMail
"TCP Query User{C854CB5E-4FBB-4773-A1E8-DAE4627F0333}c:\\program files\\zattoo\\zattood.exe"= UDP:c:\program files\zattoo\zattood.exe:zattood
"UDP Query User{4CB735B9-0934-4142-8965-B143E496E96B}c:\\program files\\zattoo\\zattood.exe"= TCP:c:\program files\zattoo\zattood.exe:zattood
"TCP Query User{6A68A205-82C4-4180-A76E-F8B16512288F}c:\\program files\\concept design\\onlinetv 4\\onlinetv.exe"= UDP:c:\program files\concept design\onlinetv 4\onlinetv.exe:onlineTV 4
"UDP Query User{A3D4B579-88AB-469A-BFEE-5ADD02E45134}c:\\program files\\concept design\\onlinetv 4\\onlinetv.exe"= TCP:c:\program files\concept design\onlinetv 4\onlinetv.exe:onlineTV 4
"TCP Query User{1E0291F4-90A6-453A-849F-511C8C5C4103}c:\\program files\\free download manager\\fdmwi.exe"= UDP:c:\program files\free download manager\fdmwi.exe:fdmwi
"UDP Query User{A4AE5B23-15C9-4BA7-ABCF-C4D2A8245245}c:\\program files\\free download manager\\fdmwi.exe"= TCP:c:\program files\free download manager\fdmwi.exe:fdmwi
"TCP Query User{8A128509-1ECD-43C5-8499-7C730551746F}c:\\program files\\participatory culture foundation\\miro\\xulrunner\\python\\miro_downloader.exe"= UDP:c:\program files\participatory culture foundation\miro\xulrunner\python\miro_downloader.exe:Miro_Downloader
"UDP Query User{6CAA510D-2A3A-461F-8A1C-CE2E8F114ED6}c:\\program files\\participatory culture foundation\\miro\\xulrunner\\python\\miro_downloader.exe"= TCP:c:\program files\participatory culture foundation\miro\xulrunner\python\miro_downloader.exe:Miro_Downloader
"{6F5B50D5-4FC1-4BC4-A086-34D4AA0CDF27}"= Disabled:UDP:E:\fsetup.exe:AVM FSetup Application
"{6DA3332E-888C-416C-B899-050BFE03EEB1}"= Disabled:TCP:E:\fsetup.exe:AVM FSetup Application
"{3B7DAA0D-DF4C-419E-B9EC-8F46B16AE6F2}"= UDP:86:BroadCam Web Server

R2 BroadCamService;BroadCam Service;c:\program files\NCH Software\BroadCam\broadCam.exe [2009-02-10 368644]
R3 AVMUNET;AVM FRITZ!Box;c:\windows\System32\drivers\avmunet.sys [2008-06-17 14976]
S2 Ca533av;Icatch(IV) Video Camera Device;c:\windows\System32\drivers\Ca533av.sys [2008-10-13 522101]
S3 getPlus(R) Helper;getPlus(R) Helper;c:\program files\NOS\bin\getPlus_HelperSvc.exe [2008-12-17 33752]
S3 USBCamera;Icatch(IV) Still Camera Device;c:\windows\System32\drivers\Bulk533.sys [2008-10-13 11108]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{302d9cb6-3c4b-11dd-b970-806e6f6e6963}]
\shell\AutoRun\command - J:\preinst.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{56ccfa6c-f403-11dd-a8b4-806e6f6e6963}]
\shell\AutoRun\command - F:\preinst.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{beb40c3d-4696-11dd-b965-806e6f6e6963}]
\shell\AutoRun\command - F:\preinst.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{eefdc70c-3d0c-11dd-9441-806e6f6e6963}]
\shell\AutoRun\command - F:\preinst.exe
.
Inhalt des "geplante Tasks" Ordners

2009-02-12 c:\windows\Tasks\User_Feed_Synchronization-{D4C0DE70-B697-40B8-A127-7BADD63E2737}.job
- c:\windows\system32\msfeedssync.exe [2008-01-19 08:33]
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -

HKCU-Run-lptae - c:\users\lm\appdata\local\lptae.exe
HKCU-Run-Software Informer - c:\program files\Software Informer\softinfo.exe
HKCU-Run-fsm - (no file)
HKLM-Run-Performance Center - c:\program files\Ascentive\Performance Center\ApcMain.exe


.
------- Zusätzlicher Suchlauf -------
.
uStart Page = hxxp://www.wortundgeist.de/
mStart Page = hxxp://de.yahoo.com
uInternet Settings,ProxyOverride = fritz.box
IE: Download with Xilisoft Download YouTube Video - c:\program files\Xilisoft\Download YouTube Video\upod_link.HTM
IE: {{4C826F10-D34B-4ba8-B609-1FB8C6482A05} - c:\casino\Europa Casino\casino.exe
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-02-13 14:58:18
Windows 6.0.6001 Service Pack 1 NTFS

Scanne versteckte Prozesse...

Scanne versteckte Autostarteinträge...

Scanne versteckte Dateien...

Scan erfolgreich abgeschlossen
versteckte Dateien: 0

**************************************************************************
.
Zeit der Fertigstellung: 2009-02-13 15:00:05
ComboFix-quarantined-files.txt  2009-02-13 14:00:03

Vor Suchlauf: 22 Verzeichnis(se), 233.036.570.624 Bytes frei
Nach Suchlauf: 22 Verzeichnis(se), 233,535,184,896 Bytes frei

250   --- E O F ---   2009-02-13 08:47:23
 

sag ich doch, da ist noch was...
start ausfüren kopiere
combofix /u
drücke enter.
Start ausfüren gebe ein:
regedit:
navigiere zum schlüssel:
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
auf der rechten seite:
"AntiVirusOverride"=dword:00000001
auf bearbeiten klicken und die 1 in eine 0 endern.
schließen


hohl dir den ccleaner
extras liste der instalierten programme erstelle die textdatei und poste sie
auch ein hijackthis-log
 
ps hier der link:
www.ccleaner.de/ - 9k -

Was mich momentan noch stört, ehe ich weitermache ...
Mein Drucker reagiert nicht mehr, seit ich den Scan gemacht habe. Woran kann das denn nun liegen?

ich sehe nichts, was deinen drucker abgeschossen haben könte, instaliere ihn einfach neu

hallo,

combofix löscht gerne mal drucker treiber.....
hasst du ein HP drucker ?

mfg Zidane